As observed in your post, 3 months of data is insufficient. Frankly, I amazed this didn't occur to anyone on your project, as it seems glaringly obvious - doesn't sound awfully competent. You have to have at least thirteen months of data.
ST03 is insufficient for identifying unused programs. It does not cover programs called by other programs, e.g. SAPScript Print Programs.
Given the above, most, if not all customers I've worked for would consider your approach dangerously risky. Having to recover programs to production is indicative of project failure. At least when we first tried this approach (and abandoned it) we did some testing first.
UPL is SAP's supplied solution. You should use that, or not bother with the exercise.